CVE-2022-26521

Published: Mar 10, 2022Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).

Affected (1)

Products: Abantecart: Abantecart

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Abantecart Abantecart	Up to 1.3.2

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

http://packetstormsecurity.com/files/171487/Abantecart-1.3.2-Remote-Code-Execution.html

Source: cve@mitre.org

https://github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txt

Source: cve@mitre.org

ExploitThird Party Advisory

http://packetstormsecurity.com/files/171487/Abantecart-1.3.2-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.